I would suggest using cookies. It would be easy to change the existing scripts to do this. The level of security would then depend on what is stored in the cookie. Typically, when I do this, I authenticate the user, and then create a random session variable in a database. The cookie will then only have the username and session variable - no password. Then on each call, I check that the session variable passed by the cookie is valid and that it is for the correct user.

See merlyn's node: Adding "state" to HTTP for other methods, then if you're still interested see the Web Techniques columns...

Afterthought: The other responses to this question deal more with encrypting the data. My method (I believe) is secure so long as you use SSL for the original authentication. It seems to me that your problem is not so much about "sniffing" but more that if someone leaves their pc while logged in, someone could come along, "view source" and see the password. Even if you encrypt the password using client-side script or MD5, then people can still impersonate other users because your script relies on the encrypted data being posted which doesn't change between logins. If you have a database of valid session IDs, then they are no longer valid once someone has logged off - i.e. next time they log in, they will have a different session ID.

$code or die
Using perl at
The Spiders Web